# x402 on-chain audits

> Pay-per-call on-chain API for agents: (1) wallet audit — token balances, total gas spent and recent transactions for any 0x address across Optimism, Base and Ethereum Mainnet; (2) token safety audit — honeypot simulation, buy/sell/transfer taxes, liquidity USD, holders, source verification, proxy and owner renouncement on Base, with a 0-100 safety score and verdict (safe/caution/danger); (3) live gas prices — gasPrice, maxPriorityFee (EIP-1559) and latest block for Base, Optimism and Ethereum Mainnet; (4) token prices — spot USD price, supply and market cap for up to 30 tokens at once on Base, computed on-chain from the most liquid DEX pool (Uniswap V3 + Aerodrome V2, no external market API); (5) transaction status — receipt for any Base tx hash: success/reverted, block, gas used, from/to, value, log count; (6) wallet balances — native ETH or any ERC-20 balance for any address on Base, Optimism or Ethereum Mainnet, with decimals and formatted value; (7) ENS name resolution — forward (name to address) and reverse (address to ENS name) via the ENS registry on Ethereum Mainnet, Base or Optimism; (8) block data — timestamp, baseFee, gas used, transaction count, proposer and hashes for any block on Base, Optimism or Ethereum Mainnet (latest, earliest or block number); (9) ERC-20 allowance — how much a spender contract can spend from an owner wallet for any ERC-20 token (USDC etc.) on Base, Optimism or Ethereum Mainnet, with decimals, symbol and block number; (10) transaction simulation — eth_call pre-flight of from/to/data/value on Base, Optimism or Ethereum Mainnet: success flag, return data, decoded revert reason (Error(string)) and gas estimate, the "will this tx work?" call before signing; (11) swap quote — amountOut on-chain for any ERC-20 pair on Base (Uniswap V3 best liquidity / Aerodrome V2, WETH route when no direct pair): spot price, price impact and minOut slippage guards (0.5%/1%) from pool reserves, no market API; (12) multicall — batch of up to 20 read-only calls (balances, allowances, symbols, any eth_call) via the canonical Multicall3 contract on Base, Optimism or Ethereum Mainnet with per-call success flag (a reverting call doesn't fail the batch), returnData and gas estimate; (13) on-chain events — raw event logs (eth_getLogs) of any contract or wallet on Base, Optimism or Ethereum Mainnet with block range filters, per-event timestamp, and best-effort decoded Transfer (from/to/value formatted with contract decimals), Approval (owner/spender/value) and Uniswap V3 Swap (sender/recipient/amount0/amount1/sqrtPriceX96/liquidity/tick); (14) wallet activity — ERC-20 Transfer history of any address (incoming/outgoing, any token, no token address needed) on Base, Optimism or Ethereum Mainnet with per-transfer timestamp, txHash, formatted value with the token's own decimals and the native ETH balance delta over the window — the "did my payment land?" check for payouts, bounties and airdrops; (15) DEX pair discovery — every Uniswap V2 + Uniswap V3 pool (fees 100/500/3000/10000) of any token on Base, Optimism or Ethereum Mainnet against curated base tokens (WETH/USDC/USDT/DAI + chain majors, or your own via bases=): per-pool address, venue, fee tier, token0/token1 (symbol + decimals), reserves (V2) or sqrtPriceX96 + liquidity (V3), spot price of the token in the quote token and in USD, and a liquidity estimate in USD — all computed on-chain from the DEX factories (no indexer, no market API); (16) wallet snapshot — native ETH + curated tokens with USD prices and total value for any address on Base, Optimism or Ethereum Mainnet in one call (the portfolio question); (17) full transaction intel — receipt + raw tx (input calldata, nonce, EIP-1559 fees) + block timestamp + confirmations + decoded function call (~40 known selectors with typed args) + event summary for any tx hash on Base, Optimism or Ethereum Mainnet — the "what did this tx do and what did it cost?" call.; (18) offline calldata decoder — raw transaction calldata in, decoded function call out (4-byte selector resolved against ~40 known functions — transfer/approve/swapExact*Tokens*/deposit/withdraw/mint/burn/supply/borrow/repay/multicall/addLiquidity/removeLiquidity/safeTransferFrom/setApprovalForAll/execute/execTransaction — with TYPED, NAMED arguments, plus NESTED decoding of inner sub-calls: multicall bytes[] up to 32 entries, Gnosis Safe execute/execTransaction data) — pure ABI decoding with no RPC, no explorer, instant response: the "what will this calldata execute?" answer before signing or relaying a transaction received from third parties (multisig, relayer, mempool).; (19) offline calldata encoder — mirror of the decoder: function name (same ~40-function dictionary) or 4-byte selector + arguments as JSON (named object or positional array; uintN as decimal string or 0x hex, address 0x+40hex, bool, bytes as 0x hex) in, raw calldata hex ready to sign out, with an embedded ROUND-TRIP verification (verify shows the decoded call — what this calldata will execute, confirmed before you sign) — pure ABI encoding with no RPC, no explorer, instant response: build the calldata you want for multisig/relayer/bot calls and check what it does in the same call.; (20) offline EIP-712 typed data — domain + types + primaryType + message JSON in, the normalized typed data plus domainSeparator, hashStruct and the final digest (the 32-byte value the wallet signs) out; with an optional signature (0x+65 bytes) it recovers the signer address (ecrecover), confirmed against an optional expectedAddress (recover.ok) — structs nest (arrays of structs, custom domain types like Permit2), uintN as decimal string or 0x hex, addresses 0x+40hex, bytes as 0x hex; build/check the typed data your wallet signs (Permit/Permit2/relayer/off-chain votes) and verify who signed it, in one call — pure cryptography with no RPC, no explorer, instant response.; (21) offline ABI selector generator — a human function signature in (transfer(address,uint256), optional parameter names transfer(address to, uint256 value), arrays address[], tuples (bytes,address,uint256,uint256)) and the 4-byte selector out (0xa9059cbb), with the full keccak256 and the parsed inputs (type + name); kind=event switches to the 32-byte topic0 for log filtering (Transfer/Approval/Swap/Sync/Paused...); every result carries a round-trip verification (verify.known — is this function/event in the /decode dictionary?); the signature calculator for calldata builders and log filters — pure cryptography with no RPC, no explorer, instant response.; (22) offline ABI map generator — a contract ABI (JSON array of entries) in, the full selector map out: 4-byte selector + canonical signature + typed inputs/outputs for every function, 32-byte topic0 for every event (indexed/anonymous flags) and 4-byte selector for every error, each with a round-trip verification (verify.known — which functions/events the /decode dictionary already decodes/encodes); tuples (type 'tuple' + components), dynamic and fixed arrays, up to 300 entries; the one-call contract interface map for calldata builders, indexers and log filters — pure cryptography with no RPC, no explorer, instant response.

## Endpoints
- [GET /audit?address=0x...](https://x402-audit.tatschluizguilherme.workers.dev/audit?address=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045): paid endpoint (wallet audit). First request returns HTTP 402 with machine-readable paymentRequirements (exact scheme, $0.25 USDC, eip155:8453). Pay with any x402 client and re-send with the PAYMENT-SIGNATURE header to receive the full audit JSON.
- [GET /token?address=0x...](https://x402-audit.tatschluizguilherme.workers.dev/token?address=0x3e12b9d6a4d12cd9b4a6d613872d0eb32f68b380): paid endpoint (token safety audit, Base). Same 402 flow, $0.25 USDC. Returns safety score 0-100, verdict, reasons and raw checks.
- [GET /gas](https://x402-audit.tatschluizguilherme.workers.dev/gas): paid endpoint (live gas prices). Same 402 flow, $0.10 USDC. Optional ?chain=base|op|mainnet|all (default all). Returns gasPrice, maxPriorityFee (EIP-1559) and latest block per chain.
- [GET /price?address=0x...](https://x402-audit.tatschluizguilherme.workers.dev/price?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913): paid endpoint (token prices on Base, Optimism or Ethereum Mainnet). Same 402 flow, $0.10 USDC. Comma-separated addresses (up to 30), optional ?chain=base|op|mainnet (default base). Returns spot USD price, supply and market cap per token, computed on-chain from the most liquid DEX pool (Uniswap V3 + Uniswap V2).
- [GET /tx?hash=0x...](https://x402-audit.tatschluizguilherme.workers.dev/tx?hash=0x941a93c4a4d7c5f2c14b0a4f3c6b1f7a0a5b4e3d2c1f0e9a8b7c6d5e4f3a2b1c0): paid endpoint (transaction status on Base). Same 402 flow, $0.10 USDC. Returns the on-chain receipt: success/reverted, block number, gas used, from/to, value and log count for any tx hash.
- [GET /tx-full?hash=0x...&chain=base](https://x402-audit.tatschluizguilherme.workers.dev/tx-full?hash=0x4b3c762f0eec8b264f177e82505a24c9992519b0e2ef05850f8689a4f1719f4b&chain=base): paid endpoint (full transaction intel on Base, Optimism or Ethereum Mainnet). Same 402 flow, $0.10 USDC. ?hash = tx hash (0x + 64 hex, required), ?chain = base|op|mainnet (default base). Returns receipt (success/reverted, gas used, log count) + raw tx (from/to, value, nonce, type, EIP-1559 fees, full input calldata with size) + block timestamp (unix + ISO) + confirmations + the decoded function call (4-byte selector resolved against ~40 known functions — transfer/approve/transferFrom/swapExact*Tokens*/exactInput/deposit/withdraw/mint/burn/supply/borrow/repay/multicall/addLiquidity/removeLiquidity/safeTransferFrom/setApprovalForAll/execute... — with typed arguments when the ABI is known) + an event summary (Transfer/Approval/Swap/Deposit/Withdrawal/Sync/PairCreated/OwnershipTransferred...). The "what did this tx do and what did it cost?" call after every settlement, swap or payment — no explorer, no API key.
- [GET /decode?data=0x...](https://x402-audit.tatschluizguilherme.workers.dev/decode?data=0xa9059cbb000000000000000000000000d8dA6BF26964aF9D7eEd9e03E53415D37aA9604500000000000000000000000000000000000000000000000000000000000f4240): paid endpoint (offline calldata decoder — chain-agnostic, no RPC). Same 402 flow, $0.10 USDC. ?data = raw transaction calldata as hex (0x..., up to 64KB; may be 0x for native ETH transfers). Returns inputSize, the 4-byte selector, the known function (name + ABI signature), the TYPED decoded arguments (args array + argsNamed object with parameter names) and — when the calldata wraps inner calls — the NESTED decoding of sub-chamadas (multicall bytes[] up to 32 entries, Gnosis Safe execute/execTransaction data). Unknown selectors return known:false honestly. Pure ABI decoding, instant response, no explorer, no API key — the "what will this calldata execute?" answer before signing or relaying a transaction received from third parties (multisig, relayer, mempool).
- [GET /encode?fn=transfer&args={"to":"0x...","value":"1000000"}](https://x402-audit.tatschluizguilherme.workers.dev/encode?fn=transfer&args=%7B%22to%22%3A%220xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045%22%2C%22value%22%3A%221000000%22%7D): paid endpoint (offline calldata encoder — mirror of /decode, chain-agnostic, no RPC). Same 402 flow, $0.10 USDC. ?fn = function name (transfer/approve/transferFrom/swapExact*Tokens*/deposit/withdraw/mint/burn/supply/borrow/repay/multicall/addLiquidity/removeLiquidity/safeTransferFrom/setApprovalForAll/execute/execTransaction — same ~40-function dictionary) or 4-byte selector (0xa9059cbb); ambiguous overloads resolve by the provided args (count or keys), or use the selector; ?args = JSON (named object or positional array; uintN as decimal string or 0x hex, address as 0x+40hex, bool true/false, bytes as 0x hex; omit for functions without arguments). Returns the raw calldata hex ready to sign (calldata + inputSize) plus an embedded ROUND-TRIP verification (verify: the generated calldata decoded by the same /decode dictionary — what this calldata will execute, confirmed before you sign). Pure ABI encoding, instant response, no explorer, no API key — build the calldata you want for multisig/relayer/bot calls and check what it does in the same call.
- [GET /eip712?data={"domain":{...},"types":{...},"primaryType":"Permit","message":{...}}](https://x402-audit.tatschluizguilherme.workers.dev/eip712?data=%7B%22domain%22%3A%7B%22name%22%3A%22USDC%22%2C%22version%22%3A%222%22%2C%22chainId%22%3A8453%2C%22verifyingContract%22%3A%220x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913%22%7D%2C%22types%22%3A%7B%22Permit%22%3A%5B%7B%22name%22%3A%22owner%22%2C%22type%22%3A%22address%22%7D%2C%7B%22name%22%3A%22spender%22%2C%22type%22%3A%22address%22%7D%2C%7B%22name%22%3A%22value%22%2C%22type%22%3A%22uint256%22%7D%2C%7B%22name%22%3A%22nonce%22%2C%22type%22%3A%22uint256%22%7D%2C%7B%22name%22%3A%22deadline%22%2C%22type%22%3A%22uint256%22%7D%5D%7D%2C%22primaryType%22%3A%22Permit%22%2C%22message%22%3A%7B%22owner%22%3A%220xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045%22%2C%22spender%22%3A%220x1111111111111111111111111111111111111111%22%2C%22value%22%3A%221000000%22%2C%22nonce%22%3A%220%22%2C%22deadline%22%3A%221900000000%22%7D%7D): paid endpoint (offline EIP-712 typed data — chain-agnostic, no RPC). Same 402 flow, $0.10 USDC. ?data = URL-encoded JSON: {"domain":{name,version,chainId,verifyingContract,salt — any subset}, "types":{struct map, EIP712Domain optional}, "primaryType":"Permit", "message":{...}, optional "signature":"0x+65bytes", optional "expectedAddress":"0x..."}. Returns the normalized typed data plus domainSeparator, the message hashStruct and the final digest (the 32-byte value the wallet signs — EIP-712 keccak256(0x1901 || domainSeparator || hashStruct)); with a signature it recovers the signer address (ecrecover) and, with expectedAddress, confirms recover.ok. Structs nest (arrays of structs, custom domain types like Permit2), uintN as decimal string or 0x hex, addresses 0x+40hex, bytes as 0x hex. Pure cryptography, instant response, no explorer, no API key — build/check the typed data your wallet signs (Permit/Permit2/relayer/off-chain votes) and verify who signed it, in one call.
- [GET /selector?sig=transfer(address,uint256)](https://x402-audit.tatschluizguilherme.workers.dev/selector?sig=transfer(address,uint256)): paid endpoint (offline ABI selector generator — chain-agnostic, no RPC). Same 402 flow, $0.10 USDC. ?sig = human function signature (transfer(address,uint256); parameter names optional — transfer(address to, uint256 value); arrays address[]; tuples (bytes,address,uint256,uint256); up to 2KB), optional &kind=event for the 32-byte topic0 (Transfer/Approval/Swap/Sync/Paused...). Returns the canonical signature, the parsed inputs (type + name), the full keccak256, the 4-byte selector (functions) or topic0 (events) and a round-trip verification (verify.known — is this function/event in the /decode dictionary? e.g. transfer → known:true). Pure cryptography, instant response, no explorer, no API key — the signature calculator for calldata builders and log filters.
- [GET /abi?abi=[{...}]](https://x402-audit.tatschluizguilherme.workers.dev/abi?abi=%5B%7B%22type%22%3A%22function%22%2C%22name%22%3A%22transfer%22%2C%22inputs%22%3A%5B%7B%22name%22%3A%22to%22%2C%22type%22%3A%22address%22%7D%2C%7B%22name%22%3A%22value%22%2C%22type%22%3A%22uint256%22%7D%5D%7D%5D): paid endpoint (offline ABI map generator — chain-agnostic, no RPC). Same 402 flow, $0.10 USDC. ?abi = URL-encoded contract ABI as a JSON array of entries (function/event/error/constructor/fallback/receive; tuples as type 'tuple' + components; dynamic and fixed arrays; up to 300 entries, 64KB). Returns the full selector map: per function the 4-byte selector + canonical signature + typed inputs/outputs + stateMutability, per event the 32-byte topic0 + indexed/anonymous flags, per error the 4-byte selector — each with a round-trip verification (verify.known: is this function/event in the /decode dictionary? e.g. transfer → known:true). The one-call contract interface map for calldata builders, indexers and log filters. Pure cryptography, instant response, no explorer, no API key.
- [GET /ens?name=vitalik.eth](https://x402-audit.tatschluizguilherme.workers.dev/ens?name=vitalik.eth): paid endpoint (ENS name resolution). Same 402 flow, $0.10 USDC. Forward (?name=vitalik.eth → address) or reverse (?address=0x... → ENS name) via the ENS registry, on ?chain=mainnet|base|op (default mainnet). Returns found flag, address/name and resolver.
- [GET /block](https://x402-audit.tatschluizguilherme.workers.dev/block?chain=base): paid endpoint (block data). Same 402 flow, $0.10 USDC. Optional ?block=latest|earliest|<number decimal or hex> and ?chain=base|op|mainnet (default base). Returns number, hash, parentHash, timestamp (unix + ISO), baseFee (wei + gwei), gasUsed/gasLimit, transactionCount, proposer and size for any block — or found:false when the block doesn't exist yet.
- [GET /allowance?token=0x...&owner=0x...&spender=0x...](https://x402-audit.tatschluizguilherme.workers.dev/allowance?token=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&owner=0x8e8d53a67b59E6f2A28e0d6d52012A2b0e3E1886&spender=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045): paid endpoint (ERC-20 allowance). Same 402 flow, $0.10 USDC. ?chain=base|op|mainnet (default base). Returns how much the spender can spend from the owner's token balance: allowanceWei + allowanceFormatted, decimals, symbol, tokenExists and block number — the pre-flight check before approving a spender.
- [GET /simulate?from=0x...&to=0x...](https://x402-audit.tatschluizguilherme.workers.dev/simulate?from=0x8e8d53a67b59E6f2A28e0d6d52012A2b0e3E1886&to=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&data=0x70a08231000000000000000000000000d8dA6BF26964aF9D7eEd9e03E53415D37aA96045): paid endpoint (transaction simulation). Same 402 flow, $0.10 USDC. Optional ?data=0x... (hex calldata), ?value=... (wei, decimal or 0x hex) and ?gas=...; ?chain=base|op|mainnet (default base). Returns success flag, returnData + returnDataDecoded, decoded revertReason (Error(string)) when it reverts, gasEstimate and blockNumber — the pre-flight call before signing any transaction. Simulation runs on the current block state; the real result may differ between simulation and send (noted in the JSON).
- [GET /swap?in=0x...&out=0x...&amountIn=...](https://x402-audit.tatschluizguilherme.workers.dev/swap?in=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&out=0x4200000000000000000000000000000000000006&amountIn=1000000): paid endpoint (swap quote on Base). Same 402 flow, $0.10 USDC. ?in/?out = ERC-20 addresses (must differ), ?amountIn = wei (decimal or 0x hex, > 0). Returns amountOut (wei + formatted), executionPrice, spotPrice, priceImpactPct, minOut slippage guards (0.5%/1%) and the route used (Uniswap V3 fee tier / Aerodrome V2 pool, direct or via WETH) — or routeFound:false when the pair has no pool. All computed from on-chain pool reserves; no market API.
- [GET /multicall?chain=base&calls=[{"to":"0x...","data":"0x..."},...]](https://x402-audit.tatschluizguilherme.workers.dev/multicall?chain=base&calls=%5B%7B%22to%22%3A%220x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913%22%2C%22data%22%3A%220x70a082310000000000000000000000008e8d53a67b59E6f2A28e0d6d52012A2b0e3E1886%22%7D%5D): paid endpoint (MultiCall batch). Same 402 flow, $0.10 USDC. ?calls = URL-encoded JSON array of {to, data?} (1 to 20 calls), ?chain=base|op|mainnet (default base). Executes all calls read-only via the canonical Multicall3 contract on the current block state: per-call success flag + returnData, blockNumber and gasEstimate. A reverting call returns success:false without failing the batch (allowFailure=true).
- [GET /events?address=0x...&topics=0x...&fromBlock=N&toBlock=M](https://x402-audit.tatschluizguilherme.workers.dev/events?address=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&topics=0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef&limit=3): paid endpoint (on-chain events). Same 402 flow, $0.10 USDC. ?address = contract/wallet to watch (0x + 40 hex), ?topics = up to 4 comma-separated topic hashes (empty = wildcard), ?fromBlock/?toBlock = latest | earliest | decimal | 0x-hex (default: last 5000 blocks; max window 10000), ?limit = 1-50 (default 20), ?order = asc|desc (default desc), ?chain=base|op|mainnet (default base). Returns raw event logs with per-event blockNumber, timestamp (unix + ISO), txHash, logIndex, topics, data and best-effort decoded Transfer (from/to/value + formatted with contract decimals), Approval (owner/spender/value) or Uniswap V3 Swap (sender/recipient/amount0/amount1/sqrtPriceX96/liquidity/tick). Busy contracts auto-shrink the range to what the RPC accepts (rangeHint shows the effective window); truncated:true means more events exist in the range than the returned limit.
- [GET /history?address=0x...](https://x402-audit.tatschluizguilherme.workers.dev/history?address=0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045&chain=mainnet&limit=3): paid endpoint (wallet activity). Same 402 flow, $0.10 USDC. ?address = wallet to inspect (0x + 40 hex) — NO token address needed. ?direction = in|out|both (default both), ?fromBlock/?toBlock = latest | earliest | decimal | 0x-hex (default: last 1000 blocks; max window 10000), ?limit = 1-50 (default 20), ?order = asc|desc (default desc), ?chain=base|op|mainnet (default base). Returns ERC-20 Transfer history involving the wallet: per-transfer direction (in/out), blockNumber, timestamp (unix + ISO), txHash, logIndex, token address and decoded Transfer (from/to/value + formatted with the token's own decimals), plus the native ETH balance delta over the window (before/after, when the RPC supports historical balances). Busy wallets auto-shrink the range to what the RPC accepts (rangeHint); truncated:true means more transfers exist in the range than the returned limit.
- [GET /pairs?token=0x...](https://x402-audit.tatschluizguilherme.workers.dev/pairs?token=0x940181a94a35a4569e4529a3cdfb74e38fd98631&chain=base): paid endpoint (DEX pair discovery). Same 402 flow, $0.10 USDC. ?token = ERC-20 to locate (0x + 40 hex, required), ?chain = base|op|mainnet (default base), ?maxPairs = 1-20 (default 10), ?bases = optional comma-separated quote tokens (1-8, replaces the curated list WETH/USDC/USDT/DAI + chain majors). Returns every Uniswap V2 + Uniswap V3 pool (fees 100/500/3000/10000) where the token trades: per-pool venue, address, feeTier, feePct, token0/token1 (address + symbol + decimals), tokenIsToken0, quote, spot priceInQuote, priceUsd, liquidityUsd (V2: 2 x quote reserve x price; V3: virtual TVL approximation 2 x L x sqrt(P)), reserves (V2) or sqrtPriceX96 + liquidity (V3), plus count/truncated. Pairs with zero reserves are filtered; sorted by liquidity desc. All on-chain from the DEX factories — no indexer, no market API.
- [GET /wallet?address=0x...](https://x402-audit.tatschluizguilherme.workers.dev/wallet?address=0x8e8d53a67b59E6f2A28e0d6d52012A2b0e3E1886&chain=base): paid endpoint (wallet snapshot). Same 402 flow, $0.10 USDC. ?address = wallet to snapshot (0x + 40 hex, required), ?chain = base|op|mainnet (default base), ?tokens = optional comma-separated ERC-20 addresses (1-20) added to the curated list (WETH/USDC/USDT/DAI + cbBTC/AERO on Base, OP/WBTC on Optimism, WBTC on Mainnet). Returns native ETH plus each token with decimals, balanceWei, balanceFormatted, priceUsd (on-chain DEX pools) and valueUsd, plus count and totalUsd for the whole wallet — the one-call portfolio snapshot that replaces 5+ /balance + /price calls.
- [GET /sample](https://x402-audit.tatschluizguilherme.workers.dev/sample): free sample wallet report (real audit of vitalik.eth, 3 chains) — no payment required.
- [GET /sample-token](https://x402-audit.tatschluizguilherme.workers.dev/sample-token): free sample token report (real honeypot caught on Base — FLOWER) — no payment required.
- [GET /](https://x402-audit.tatschluizguilherme.workers.dev/): landing page + machine-readable API description (Accept: application/json).

## Pricing
- $0.25 USDC per audit call (wallet or token), $0.10 USDC per gas call, $0.10 USDC per price call, $0.10 USDC per tx call, $0.10 USDC per tx-full call, $0.10 USDC per decode call, $0.10 USDC per encode call, $0.10 USDC per eip712 call, $0.10 USDC per selector call, $0.10 USDC per abi map call, $0.10 USDC per balance call, $0.10 USDC per ENS call, $0.10 USDC per block call, $0.10 USDC per allowance call, $0.10 USDC per simulate call, $0.10 USDC per swap call, $0.10 USDC per multicall batch, $0.10 USDC per events call, $0.10 USDC per history call, $0.10 USDC per pairs call, $0.10 USDC per wallet snapshot call, settled on Base (eip155:8453) via the x402 exact scheme.
- Failed chains are reported in the JSON error field, not re-charged.

## How to pay (machine-readable)
1. GET /audit?address=0x... (or /token?address=0x..., or /gas) -> HTTP 402 + paymentRequirements JSON
2. Your x402 client pays (EIP-3009 transferWithAuthorization) to the payTo address in the requirements
3. Re-send the original request with the PAYMENT-SIGNATURE header -> HTTP 200 with the JSON

## Spec
- [GET /openapi.json](https://x402-audit.tatschluizguilherme.workers.dev/openapi.json): OpenAPI 3.0 spec of this API — machine-readable, standard discovery for agent tools (Claude actions, GPTs, SDKs).
- [x402 protocol docs](https://docs.x402.org): protocol for HTTP 402 pay-per-call APIs.
- Operator: hermes-ops. Payments settle to the operator wallet; the settlement key holds gas only.